@parlor/auth 0.0.0-stage → 0.1.0

package/dist/revocation.js

@@ -0,0 +1,233 @@
+import { sql } from "drizzle-orm";
+import { rowsOf } from "./database.js";
+export const REVOCATION_CHANNEL = "parlor_auth";
+const keyOf = ({ kind, id }) => `${kind}:${id}`;
+const owner = Symbol("parlor.revocation.owner");
+/**
+ * Every instance's view of what was revoked within the horizon. It loads before it
+ * admits anyone, and whenever its LISTEN connection drops it checks the table per call
+ * until it listens again and reloads, because a NOTIFY sent meanwhile is lost.
+ */
+export class RevocationSet {
+    #database;
+    #horizonMs;
+    #now;
+    #relistenBaseMs;
+    #relistenMaxMs;
+    #revoked = new Map();
+    #watches = new Map();
+    #forget = new FinalizationRegistry((key) => this.#sweepWatch(key));
+    #mode = "starting";
+    #ready;
+    #generation = 0;
+    #unlisten;
+    #reconnecting = false;
+    #retry;
+    #sweptAt = 0;
+    #stopped = false;
+    constructor(options) {
+        this.#database = options.database;
+        this.#horizonMs = options.horizonMs;
+        this.#now = options.now ?? Date.now;
+        this.#relistenBaseMs = options.relistenBaseMs ?? 1000;
+        this.#relistenMaxMs = options.relistenMaxMs ?? 30_000;
+    }
+    get mode() {
+        return this.#mode;
+    }
+    /** Resolves once the set can answer; a failed start is retried by the next call. */
+    ready() {
+        this.#ready ??= this.#start().catch((error) => {
+            this.#ready = undefined;
+            throw error;
+        });
+        return this.#ready;
+    }
+    /**
+     * Revoked when a revocation of the notice is at or after `issuedAt`; without it, when
+     * any revocation of the notice is within the horizon.
+     */
+    async isRevoked(notice, issuedAt = 0) {
+        await this.ready();
+        const at = this.#mode === "following"
+            ? this.#revoked.get(keyOf(notice))
+            : await this.#lookup(notice);
+        return at !== undefined && at >= Math.max(issuedAt, this.#now() - this.#horizonMs);
+    }
+    /**
+     * Aborts when any of the notices is revoked at or after `since` (default: now). The
+     * watch is registered first and the revocations already known are checked after, so one
+     * that landed between `since` and this call still aborts it.
+     */
+    signal(notices, since = this.#now()) {
+        const controller = new AbortController();
+        // The signal pins its controller, so a watch lives exactly as long as its holder.
+        Object.defineProperty(controller.signal, owner, { value: controller });
+        for (const notice of notices) {
+            const key = keyOf(notice);
+            const watch = this.#watches.get(key);
+            if (watch)
+                watch.since = Math.min(watch.since, since);
+            else
+                this.#watches.set(key, { controllers: new Set(), since });
+            this.#watches.get(key).controllers.add(new WeakRef(controller));
+            this.#forget.register(controller.signal, key);
+        }
+        this.#abortIfRevoked(controller, notices, since);
+        return controller.signal;
+    }
+    /** Records the revocation in the caller's transaction; the NOTIFY goes out on commit. */
+    static async revoke(tx, notice, at = Date.now()) {
+        const db = tx;
+        await db.execute(sql `
+      insert into parlor_auth_revocations (kind, id, revoked_at)
+      values (${notice.kind}, ${notice.id}, ${new Date(at).toISOString()})
+      on conflict (kind, id) do update set revoked_at = excluded.revoked_at`);
+        const payload = { kind: notice.kind, id: notice.id, at };
+        await db.execute(sql `select pg_notify(${REVOCATION_CHANNEL}, ${JSON.stringify(payload)})`);
+    }
+    async stop() {
+        this.#stopped = true;
+        this.#generation += 1;
+        if (this.#retry !== undefined)
+            clearTimeout(this.#retry);
+        const unlisten = this.#unlisten;
+        this.#unlisten = undefined;
+        await unlisten?.().catch(() => { });
+    }
+    async #start() {
+        await this.#prune();
+        if (!this.#database.listen) {
+            this.#mode = "checking";
+            return;
+        }
+        try {
+            await this.#connect(this.#now() - this.#horizonMs);
+        }
+        catch (error) {
+            console.warn("[parlor] revocations: LISTEN failed, checking per call:", error);
+            this.#mode = "checking";
+            this.#reconnect(this.#now());
+        }
+    }
+    async #connect(since) {
+        const generation = ++this.#generation;
+        const unlisten = await this.#database.listen(REVOCATION_CHANNEL, (payload) => this.#receive(payload), { onLost: () => this.#lost(generation) });
+        if (generation !== this.#generation) {
+            await unlisten().catch(() => { });
+            return;
+        }
+        this.#unlisten = unlisten;
+        const revocations = await this.#load(since);
+        if (generation !== this.#generation)
+            return;
+        for (const revocation of revocations)
+            this.#apply(revocation);
+        this.#mode = "following";
+    }
+    #lost(generation) {
+        if (generation !== this.#generation || this.#stopped)
+            return;
+        this.#generation += 1;
+        this.#unlisten = undefined;
+        this.#mode = "checking";
+        this.#reconnect(this.#now());
+    }
+    #reconnect(lostAt) {
+        if (this.#reconnecting)
+            return;
+        this.#reconnecting = true;
+        let delay = this.#relistenBaseMs;
+        const attempt = async () => {
+            this.#retry = undefined;
+            if (this.#stopped)
+                return;
+            try {
+                await this.#connect(Math.min(lostAt, this.#now() - this.#horizonMs));
+                this.#reconnecting = false;
+            }
+            catch (error) {
+                console.warn("[parlor] revocations: LISTEN failed, retrying:", error);
+                this.#retry = setTimeout(attempt, delay);
+                delay = Math.min(delay * 2, this.#relistenMaxMs);
+            }
+        };
+        this.#retry = setTimeout(attempt, 0);
+    }
+    #receive(payload) {
+        try {
+            this.#apply(JSON.parse(payload));
+        }
+        catch {
+            console.warn("[parlor] revocations: ignored a malformed notice");
+        }
+    }
+    #apply(revocation) {
+        const key = keyOf(revocation);
+        const known = this.#revoked.get(key);
+        if (known === undefined || revocation.at > known)
+            this.#revoked.set(key, revocation.at);
+        this.#sweepExpired();
+        const watch = this.#watches.get(key);
+        if (!watch || revocation.at < watch.since)
+            return;
+        this.#watches.delete(key);
+        for (const ref of watch.controllers)
+            ref.deref()?.abort();
+    }
+    #abortIfRevoked(controller, notices, since) {
+        const floor = Math.max(since, this.#now() - this.#horizonMs);
+        if (this.#mode === "following") {
+            const hit = notices.some((notice) => (this.#revoked.get(keyOf(notice)) ?? -1) >= floor);
+            if (hit)
+                controller.abort();
+            return;
+        }
+        Promise.all(notices.map((notice) => this.#lookup(notice))).then((found) => {
+            if (found.some((at) => at !== undefined && at >= floor))
+                controller.abort();
+        }, () => controller.abort());
+    }
+    #sweepExpired() {
+        const now = this.#now();
+        if (now - this.#sweptAt < this.#horizonMs)
+            return;
+        this.#sweptAt = now;
+        for (const [key, at] of this.#revoked) {
+            if (at < now - this.#horizonMs)
+                this.#revoked.delete(key);
+        }
+    }
+    #sweepWatch(key) {
+        const watch = this.#watches.get(key);
+        if (!watch)
+            return;
+        for (const ref of watch.controllers)
+            if (!ref.deref())
+                watch.controllers.delete(ref);
+        if (watch.controllers.size === 0)
+            this.#watches.delete(key);
+    }
+    async #lookup(notice) {
+        const rows = rowsOf(await this.#database.read().execute(sql `
+        select revoked_at from parlor_auth_revocations
+        where kind = ${notice.kind} and id = ${notice.id}`));
+        const row = rows[0];
+        return row ? new Date(row.revoked_at).getTime() : undefined;
+    }
+    async #load(since) {
+        const rows = rowsOf(await this.#database.read().execute(sql `
+        select kind, id, revoked_at from parlor_auth_revocations
+        where revoked_at >= ${new Date(since).toISOString()}`));
+        return rows.map((row) => ({
+            kind: row.kind,
+            id: row.id,
+            at: new Date(row.revoked_at).getTime(),
+        }));
+    }
+    async #prune() {
+        const cutoff = new Date(this.#now() - this.#horizonMs).toISOString();
+        await this.#database.read().execute(sql `delete from parlor_auth_revocations where revoked_at < ${cutoff}`);
+    }
+}
+//# sourceMappingURL=revocation.js.map

package/dist/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAiB,MAAM,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AA+BhD,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAoB,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;AAOlE,MAAM,KAAK,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACf,SAAS,CAAe;IACxB,UAAU,CAAS;IACnB,IAAI,CAAe;IACnB,eAAe,CAAS;IACxB,cAAc,CAAS;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpC,OAAO,GAAG,IAAI,oBAAoB,CAAS,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,KAAK,GAAmB,UAAU,CAAC;IACnC,MAAM,CAA4B;IAClC,WAAW,GAAG,CAAC,CAAC;IAChB,SAAS,CAAoC;IAC7C,aAAa,GAAG,KAAK,CAAC;IACtB,MAAM,CAA4C;IAClD,QAAQ,GAAG,CAAC,CAAC;IACb,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,OAA6B;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACtD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACxD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,oFAAoF;IACpF,KAAK;QACH,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACrD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,MAAwB,EAAE,QAAQ,GAAG,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,EAAE,GACN,IAAI,CAAC,KAAK,KAAK,WAAW;YACxB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAoC,EAAE,KAAK,GAAW,IAAI,CAAC,IAAI,EAAE;QACtE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,kFAAkF;QAClF,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK;gBAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;gBACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,yFAAyF;IACzF,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,EAAW,EACX,MAAwB,EACxB,EAAE,GAAW,IAAI,CAAC,GAAG,EAAE;QAEvB,MAAM,EAAE,GAAG,EAAc,CAAC;QAC1B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;gBAER,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;4EACI,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;QACrE,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,oBAAoB,kBAAkB,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAO,CAC3C,kBAAkB,EAClB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EACnC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CACzC,CAAC;QACF,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW;YAAE,OAAO;QAC5C,KAAK,MAAM,UAAU,IAAI,WAAW;YAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC7D,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;gBACtE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACzC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,QAAQ,CAAC,OAAe;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,UAAsB;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK;YAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK;YAAE,OAAO;QAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW;YAAE,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IAED,eAAe,CACb,UAA2B,EAC3B,OAAoC,EACpC,KAAa;QAEb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CACtB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAC9D,CAAC;YACF,IAAI,GAAG;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7D,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,KAAK,CAAC;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QAC9E,CAAC,EACD,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,aAAa;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;YAAE,OAAO;QAClD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,WAAW,CAAC,GAAW;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrF,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAwB;QACpC,MAAM,IAAI,GAAG,MAAM,CACjB,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;uBAEpC,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,EAAE,EAAE,CAAC,CACtD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa;QACvB,MAAM,IAAI,GAAG,MAAM,CAKjB,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;8BAE7B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CACzD,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;SACvC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAC/C,GAAG,CAAA,0DAA0D,MAAM,EAAE,CACtE,CAAC;IACJ,CAAC;CACF"}

package/dist/routes.d.ts

@@ -0,0 +1,15 @@
+import { type AnyPluginRoute, type PluginHost } from "@parlor/server";
+import { type ParlorAuthSettings } from "./better-auth.js";
+import type { BetterAuthInstance } from "./provider.js";
+interface RouteDeps {
+    readonly instance: BetterAuthInstance;
+    readonly settings: ParlorAuthSettings;
+    readonly host: PluginHost;
+}
+/**
+ * Better Auth's endpoints under `/_parlor/auth`, the OAuth discovery documents MCP clients
+ * read at the origin root, and the consent page an MCP client's authorization stops at.
+ */
+export declare function authRoutes({ instance, settings, host }: RouteDeps): AnyPluginRoute[];
+export {};
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,UAAU,EAGhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,UAAU,SAAS;IACjB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAiBD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,GAAG,cAAc,EAAE,CAoGpF"}

package/dist/routes.js

@@ -0,0 +1,116 @@
+import { pluginRoute, } from "@parlor/server";
+import { AUTH_PLUGIN, CONSENT_PATH } from "./better-auth.js";
+import { escape, failure, page } from "./pages.js";
+/** A client's name is self-declared; only an https client id proves who publishes it. */
+function publisherOf(clientId) {
+    if (!clientId.startsWith("https://"))
+        return "This agent named itself; its publisher is not verified.";
+    return `Published by <strong>${escape(new URL(clientId).host)}</strong>.`;
+}
+function redirectOrigin(query) {
+    try {
+        return new URL(query.get("redirect_uri") ?? "").origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Better Auth's endpoints under `/_parlor/auth`, the OAuth discovery documents MCP clients
+ * read at the origin root, and the consent page an MCP client's authorization stops at.
+ */
+export function authRoutes({ instance, settings, host }) {
+    const forward = (method, path) => ({
+        method,
+        path,
+        access: "public",
+        handle: (request) => instance.handler(request),
+    });
+    const appName = () => instance.options.appName ?? new URL(settings.origin).host;
+    const consentPage = pluginRoute({
+        method: "GET",
+        path: CONSENT_PATH,
+        access: ["user"],
+        handle: async (request) => {
+            const query = new URL(request.url).searchParams;
+            const clientId = query.get("client_id");
+            const target = redirectOrigin(query);
+            if (!clientId || !target || !query.get("sig")) {
+                return failure("This authorization request is incomplete.", 400);
+            }
+            const session = await instance.api.getSession({ headers: request.headers });
+            if (!session)
+                return failure("Sign in again to continue.", 401);
+            const { adapter } = await instance.$context;
+            const client = await adapter.findOne({
+                model: "oauthClient",
+                where: [{ field: "clientId", value: clientId }],
+            });
+            if (!client)
+                return failure("This agent is not registered.", 400);
+            const agent = client.name || clientId;
+            const app = appName();
+            const offline = (query.get("scope") ?? "").split(" ").includes("offline_access");
+            const body = `
+<h1>Allow ${escape(agent)} to use ${escape(app)}?</h1>
+<p>${publisherOf(clientId)}</p>
+<p>Signed in as <strong>${escape(session.user.email)}</strong>.</p>
+<ul>
+<li>It can do anything you can do in ${escape(app)}, as you. Actions that ask for confirmation still ask you first.</li>
+<li>${offline ? "It stays connected until you revoke it in your account settings." : "Its access ends after a few minutes."}</li>
+<li>You will be sent back to <strong>${escape(new URL(target).host)}</strong>.</li>
+</ul>
+<form method="post" action="${escape(`${host.basePath}/${AUTH_PLUGIN}${CONSENT_PATH}`)}">
+<input type="hidden" name="oauth_query" value="${escape(query.toString())}">
+<button type="submit" name="accept" value="false">Deny</button>
+<button type="submit" name="accept" value="true" autofocus>Allow</button>
+</form>`;
+            return page(`Allow ${agent}?`, body, ["'self'", target]);
+        },
+    });
+    const consentAnswer = pluginRoute({
+        method: "POST",
+        path: CONSENT_PATH,
+        access: ["user"],
+        handle: async (request) => {
+            if (request.headers.get("origin") !== settings.origin) {
+                return failure("This answer did not come from the consent page.", 403);
+            }
+            const form = new URLSearchParams(await request.text());
+            const oauthQuery = form.get("oauth_query");
+            const accept = form.get("accept");
+            if (!oauthQuery || (accept !== "true" && accept !== "false")) {
+                return failure("This answer is incomplete.", 400);
+            }
+            const headers = new Headers({
+                "content-type": "application/json",
+                accept: "application/json",
+                origin: settings.origin,
+            });
+            const cookie = request.headers.get("cookie");
+            if (cookie)
+                headers.set("cookie", cookie);
+            const answer = await instance.handler(new Request(`${settings.baseURL}/oauth2/consent`, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ accept: accept === "true", oauth_query: oauthQuery }),
+            }));
+            const result = (await answer.json().catch(() => undefined));
+            const location = result?.url ?? result?.redirect_uri;
+            if (!answer.ok || !location) {
+                return failure(result?.message ?? "The authorization could not be completed.", 400);
+            }
+            return new Response(null, { status: 303, headers: { location } });
+        },
+    });
+    return [
+        forward("GET", "/**"),
+        forward("POST", "/**"),
+        forward("GET", "/.well-known/oauth-protected-resource"),
+        forward("GET", "/.well-known/oauth-protected-resource/**"),
+        forward("GET", "/.well-known/oauth-authorization-server/**"),
+        consentPage,
+        consentAnswer,
+    ];
+}
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,YAAY,EAA2B,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AASnD,yFAAyF;AACzF,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAClC,OAAO,yDAAyD,CAAC;IACnE,OAAO,wBAAwB,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAa;IAChE,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,IAAkB,EAAqB,EAAE,CAAC,CAAC;QAClF,MAAM;QACN,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAEhF,MAAM,WAAW,GAAG,WAAW,CAAC;QAC9B,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;YAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,OAAO,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAA2B;gBAC7D,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,OAAO,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC;YACtC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YACjF,MAAM,IAAI,GAAG;YACP,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,GAAG,CAAC;KAC1C,WAAW,CAAC,QAAQ,CAAC;0BACA,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;;uCAEb,MAAM,CAAC,GAAG,CAAC;MAC5C,OAAO,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,sCAAsC;uCACpF,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;;8BAErC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,GAAG,YAAY,EAAE,CAAC;iDACrC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;;;QAGjE,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,WAAW,CAAC;QAChC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC7D,OAAO,OAAO,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,IAAI,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,iBAAiB,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAC7E,CAAC,CACH,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAE7C,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,EAAE,GAAG,IAAI,MAAM,EAAE,YAAY,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,OAAO,CACZ,MAAM,EAAE,OAAO,IAAI,2CAA2C,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;KACF,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACrB,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;QACtB,OAAO,CAAC,KAAK,EAAE,uCAAuC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,0CAA0C,CAAC;QAC1D,OAAO,CAAC,KAAK,EAAE,4CAA4C,CAAC;QAC5D,WAAW;QACX,aAAa;KACd,CAAC;AACJ,CAAC"}